CVE-2019-3795 Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security
Spring Security allows insecure randomness if a seed is manually configured, potentially enabling attackers to predict random values.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3795?
CVE-2019-3795 is a low-severity vulnerability in Debian Debian Linux, published on 9 Apr 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Weakness: CWE-330
Which versions are affected by CVE-2019-3795?
6 open source packages ship an affected version, including org.springframework.security:spring-security-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | From 4.2.0 | 4.2.12 |
org.springframework.security:spring-security-core Maven | From 4.2.0 | 4.2.12 |
org.springframework.security:spring-security-core Maven | From 5.0.0 | 5.0.12 |
org.springframework.security:spring-security-core Maven | From 5.0.0 | 5.0.12 |
org.springframework.security:spring-security-core Maven | From 5.1.0 | 5.1.5 |
org.springframework.security:spring-security-core Maven | From 5.1.0 | 5.1.5 |
Products include Debian Debian Linux, Vmware Spring Security.
How do I fix CVE-2019-3795?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 4.2.12, 5.0.12 or 5.1.5.
Is CVE-2019-3795 being exploited?
There is no known exploitation of CVE-2019-3795 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DLA-1794-1, GHSA-v2r2-7qm7-jj6v.